rhadamanthys | cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284

General

Target

rh_0.6.0.exe
Size

355KB
MD5

464ea1bd9930cd4ecae392d7214c3905
SHA1

525be920ce25cf340d8e47a0f3fd993a908449fc
SHA256

cade479a0b203af759b0f82c80d4b95ca46abe3a4f665f365953eb5e25fe9284
SHA512

73bcb3c6119a73ccd34d8300cf4e4fc3b4abf4f7cdbba49d9ad341931785e36dc98258b0e759fe999c31b56320533f228bee8755838cb7850797ef5f14ad3aa3
SSDEEP

6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqrsb:gf2R/EEkCQFYDwRqw

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

C2

https://www.carssell.online:443/b45c71e9ac60e42309ff71/ox15jpua.xlk0e

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2316 created 1232	2316	rh_0.6.0.exe	21

Deletes itself 1 IoCs

pid	Process
2496	dialer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rh_0.6.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	rh_0.6.0.exe
2316	rh_0.6.0.exe
2496	dialer.exe
2496	dialer.exe
2496	dialer.exe
2496	dialer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	28
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	28
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	28
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	28
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	28
PID 2316 wrote to memory of 2496	2316	rh_0.6.0.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232
- C:\Users\Admin\AppData\Local\Temp\rh_0.6.0.exe
  "C:\Users\Admin\AppData\Local\Temp\rh_0.6.0.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2316
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-8-0x0000000000360000-0x00000000003CD000-memory.dmp

Filesize
436KB

Download
memory/2316-1-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2316-2-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2316-3-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2316-5-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2316-6-0x0000000075730000-0x0000000075777000-memory.dmp

Filesize
284KB

Download
memory/2316-0-0x0000000000360000-0x00000000003CD000-memory.dmp

Filesize
436KB

Download
memory/2496-7-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2496-11-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download
memory/2496-10-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download
memory/2496-13-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download
memory/2496-12-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2496-15-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2496-16-0x0000000075730000-0x0000000075777000-memory.dmp

Filesize
284KB

Download
memory/2496-17-0x0000000001F90000-0x0000000002390000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing